MODULE v1.0.0
Internet access
reads: routingEgress firewall and proxy policy, outbound NAT and ISP path health, SaaS IP allowlisting, and CDN or geo-routing effects on the public path.
What it checks
- Egress firewall policy, the rules that decide whether a host may reach the public internet at all
- Explicit and transparent web proxies that sit between the host and the public internet
- PAC files and WPAD, the mechanisms that tell a client which proxy to use for which destination
- Web and URL category filtering that blocks specific sites or content categories at the proxy
- Outbound NAT and the public source IP the SaaS endpoint sees as the caller
- ISP and WAN link health, the physical and routed path to the internet exchange
- SaaS-side IP allowlisting, where the SaaS only accepts traffic from known egress addresses
- CDN, anycast, and geo-routing, where the same hostname resolves to a different server by location
- TLS interception, where an inspection proxy terminates and re-originates the TLS session
What this module contains
Every module is a folder the engine loads. This one ships with:
module.yml, the manifest: name, vendor, version, layer, and what it covers.knowledge.md, the plain-language troubleshooting knowledge.connection.yml, which doors it reads through. A file drop, a vendor API, an MCP server, or more than one with the engine picking in a fixed order.- Worked examples.
Author: Silo7.
Stop guessing which layer broke.
Who is it for?
Anyone with the right permissions stands it up. After that, anyone working an access ticket, help desk, IT ops, or developers, gets the same evidence-backed answer.
What exactly do I get?
The engine skeleton as a Docker image, all nine modules, the command-line tool, and the browser interface. You supply your own model backend.
Does it change anything in my network?
No. It diagnoses and advises. It runs checks, including its own live network probes, and proposes a fix you perform. It makes no changes.
It is built with AI. Why should I trust it?
PathWise is built by an engineer with more than 30 years in systems infrastructure, 18 of them securing networks in regulated banking, holding the CISSP and CCSP. It solves a problem its builder has lived for two decades. You still do not have to take it on faith. PathWise cannot change your systems. The read-only boundary lives in the code, not in a request to the model, so the worst case is a wrong answer you catch, never a wrong action. Every answer shows the probes it ran and the evidence behind each claim, so you check the conclusion instead of trusting it. It ships with more than 1,600 automated tests, and an outside security review of the live app in July 2026 found no critical or high issues. And it is free to trial on your own box until the beta license expires in one year. Point it at a problem you already understand and watch what it does before you pay.
What model does it run on?
You bring your own. It runs against the Anthropic API by default, or any OpenAI-compatible backend, including a local model through Ollama or vLLM. A managed in-tenant placement is planned. The model is a quality dial you set.
Is my data sent anywhere?
Your model does the reasoning, so in the Anthropic mode your investigation data goes to your AI provider over your own key. Run a local model to keep the reasoning inside your boundary. A managed in-tenant cloud placement is planned. Probes send only the host or IP being checked.
What is a module?
A small folder of plain files describing one vendor or one layer. The standard is free and open, and you can write your own.
How is it licensed?
An annual subscription license. Solo covers one engineer. Team is licensed to one organization and covers four user accounts, with more sold in 3-packs. Modify it for internal use, no resale, as-is, copyright retained.